Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.2250
xmlbeans security update
29 June 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: xmlbeans
Publisher: Debian
Operating System: Debian GNU/Linux
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-23926
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running xmlbeans check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- --=-+x/7O5iiQfdGJBpOMOWd
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2693-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Markus Koschany
June 28, 2021 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : xmlbeans
Version : 2.6.0+dfsg-1+deb9u1
CVE ID : CVE-2021-23926
The XML parsers used by XMLBeans did not set the properties needed to prote=
ct
the user from malicious XML input. Vulnerabilities include the possibility =
for
XML Entity Expansion attacks which could lead to a denial-of-service. This
update implements sensible defaults for the XML parsers to prevent these ki=
nd
of attacks.
For Debian 9 stretch, this problem has been fixed in version
2.6.0+dfsg-1+deb9u1.
We recommend that you upgrade your xmlbeans packages.
For the detailed security status of xmlbeans please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/xmlbeans
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- --=-+x/7O5iiQfdGJBpOMOWd
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit
- -----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmDZ2VlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeSJ2hAAuVaR4BfaKkKYyYMM8gD6LKAI3oMmoJ8eI5/EPyOxSLTZdJaEjfroGz/5
hU4gTWHCVEEKzqrdLJOkP2jPARQE9YBnvEa4z9nCP2UXTNBTaexs9ZcXtlndk2x6
hDj6eYoQpuBmtVtlJvzCVNipAERAX0ZFbdtfXP2chDuQypZtWXmyQ7JhYFEazrAF
5kBtbM8oxDwtkjgNtnc8e6rK+Za9ceZ0yF5t01XJ2Ke8/NUDrm8vrm5sL1RHgkkB
1LqIV3Rc7qlfumRErUNGWQULmu5VEnxxEFbYoPBq5gvx+MpZJIUh2xt5Oz+SXBu0
2BGno7jOUZz01ex74rF309tv2ukavpPDUyU1Y2k55X2/LE/AiWRU/xXgwJTJL4qj
rlP8qa8uC2C1sDV0T3g7OiR7rauUaPwvuNPvqJUVcwManppAMX86rfAtKvc4xNkq
Ix+NTLcNMZGjC/lT3f1YhlcbS8yGgOqlKGEgYdcNu9joiElKgzh3ycJX2r7UuGHL
lhsmP2F+EJLzjS9/vql5O/0Xq4I3RJHFd292d53iiZ6a0ElNmuYXTK+LhEaS2+fN
lcz+67iU5i/KEa3l8dmGkhgRRClD3QuVKVWjw6JB5myplqDvbmQZPfEKL8ujgCfS
HPvIjsfYiLPNLNgkyTJdqIAsw9qxw67OMCNFnLmWrG4pH0j7v4A=
=yl7D
- -----END PGP SIGNATURE-----
- --=-+x/7O5iiQfdGJBpOMOWd--
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYNqX5eNLKJtyKPYoAQiwgA//WNboDHzSAWcEiXiDFDDa1FCbX4c6ml7e
UuXxJ3PTg106DUH165mKh6haFKmEfBkmXcom7e6tbGJ9kJpYl2zZ/BrYPL268V1+
hPrn92Ky9NNKXixiq4DUVucR66gwU/QDrQ+78shsg6Fq33OUbGcemBQd3eY5fyUq
ozGFz1t/kDT53MQ2AVn5b1h0fcjNmwtH+vBMFFX4ksAOkoqvwiN5x1kpmfpoMCGN
njT7xMaznhqCRx8pnlRIP6PyU+lOBTanEOitRBTZRxi7A2/PLo4r/C+kNb0SPZES
4gX6Un/PVwUf2SwryS481LgRbzVXRtKzSpw8ZTiqRpFfz4c6CmPC0PaWAf1DEVYa
EG54JUhbAhYKwQOFH9EnJe9U5WoUNRvg25miZ0tyxOI1V/e9rj9I5qdQ+dhp87nO
J7vtuhfLfnkc1Kp0lyyYapzD3me0JBk+qBg7IAtsecobh6wNADmLLI6iczY6sRju
MiwKTSieebvMRUmi9RB+bMVk9J6zSzEs3gJ+nnoVmDXsZiwGuFbNJJT265l1O08j
Rldo5sClobzz7OGX1mV1R6uJGozSTQpRU5Ktz0YT8KJWQnCoPFuASb3cxEmoHMMT
29i8GEab56hVOskFMm5FEzR2Co7tvH08EeSj2fMmiCLYc8nLoM0+pxrUZnWNTcKG
H2Pl3gGfwYk=
=nSlz
-----END PGP SIGNATURE-----